3218. [security] Cache lookup could return RRSIG data associated with

                        nonexistent records, leading to an assertion
                        failure. [RT #26590]

diff --git a/CHANGES b/CHANGES
index a7a2f873b36a5874acc51221817e8045e1492aaa..bec2f0e22569113b03f5d0e7fe96b33a48dd3de7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3218.  [security]      Cache lookup could return RRSIG data associated with
+                       nonexistent records, leading to an assertion
+                       failure. [RT #26590]
+
 3216.   [bug]           resolver.c:validated() was not thread-safe. [RT #26478]
 
        --- 9.7.5b1 released ---

diff --git a/bin/named/query.c b/bin/named/query.c
index c328939ff1228fde16605a6d6bc0ff56d1e8aa12..e67c04bebf78567a6368974bbe40aa821aee7445 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.335.8.18 2011/10/20 21:46:17 marka Exp $ */
+/* $Id: query.c,v 1.335.8.19 2011/11/16 09:53:21 marka Exp $ */
 
 /*! \file */
 
@@ -1281,11 +1281,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                        goto addname;
                if (result == DNS_R_NCACHENXRRSET) {
                        dns_rdataset_disassociate(rdataset);
-                       /*
-                        * Negative cache entries don't have sigrdatasets.
-                        */
-                       INSIST(sigrdataset == NULL ||
-                              ! dns_rdataset_isassociated(sigrdataset));
+                       if (sigrdataset != NULL &&
+                           dns_rdataset_isassociated(sigrdataset))
+                               dns_rdataset_disassociate(sigrdataset);
                }
                if (result == ISC_R_SUCCESS) {
                        mname = NULL;
@@ -1326,8 +1324,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                        goto addname;
                if (result == DNS_R_NCACHENXRRSET) {
                        dns_rdataset_disassociate(rdataset);
-                       INSIST(sigrdataset == NULL ||
-                              ! dns_rdataset_isassociated(sigrdataset));
+                       if (sigrdataset != NULL &&
+                           dns_rdataset_isassociated(sigrdataset))
+                               dns_rdataset_disassociate(sigrdataset);
                }
                if (result == ISC_R_SUCCESS) {
                        mname = NULL;
@@ -1777,10 +1776,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                goto setcache;
        if (result == DNS_R_NCACHENXRRSET) {
                dns_rdataset_disassociate(rdataset);
-               /*
-                * Negative cache entries don't have sigrdatasets.
-                */
-               INSIST(! dns_rdataset_isassociated(sigrdataset));
+               if (dns_rdataset_isassociated(sigrdataset))
+                       dns_rdataset_disassociate(sigrdataset);
        }
        if (result == ISC_R_SUCCESS) {
                /* Remember the result as a cache */

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index d6ebe0ea5537fcbefc8965f2e3f151eae22f0891..7f2516b9dfbdd7b68c38303ccc376532f28370c2 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.292.8.24 2011/11/08 21:09:09 marka Exp $ */
+/* $Id: rbtdb.c,v 1.292.8.25 2011/11/16 09:53:21 marka Exp $ */
 
 /*! \file */
 
@@ -4810,7 +4810,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
                              rdataset);
                if (need_headerupdate(found, search.now))
                        update = found;
-               if (foundsig != NULL) {
+               if (!NEGATIVE(found) && foundsig != NULL) {
                        bind_rdataset(search.rbtdb, node, foundsig, search.now,
                                      sigrdataset);
                        if (need_headerupdate(foundsig, search.now))
@@ -5443,7 +5443,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
        }
        if (found != NULL) {
                bind_rdataset(rbtdb, rbtnode, found, now, rdataset);
-               if (foundsig != NULL)
+               if (!NEGATIVE(found) && foundsig != NULL)
                        bind_rdataset(rbtdb, rbtnode, foundsig, now,
                                      sigrdataset);
        }